To clarify, by 'illegal' I meant non-compliant.
These headers _are_ used, as we have run into them in production in our
business coming from clients, and some time on stack overflow shows these
are becoming more and more common. They are also RFC-compliant, and
competing products support them.
Posted at Nginx Forum: https://forum.nginx.org/read.php?2,279116,279132#msg-279132